Bug 29770

Summary:	SIGSEGV program/ir_to_mesa.cpp:1596
Product:	Mesa	Reporter:	Vinson Lee <vlee>
Component:	Mesa core	Assignee:	Eric Anholt <eric>
Status:	CLOSED FIXED	QA Contact:
Severity:	critical
Priority:	medium
Version:	git
Hardware:	x86 (IA32)
OS:	Linux (All)
Whiteboard:
i915 platform:		i915 features:

Description Vinson Lee 2010-08-23 16:52:14 UTC

mesa: 87f44d5723ebb3a2efe0dddc1a6edb6536adea4d (master)

Run piglit glsl-array-bounds-02 on swrast.

(gdb) bt
#0  0x0067c5ae in ir_to_mesa_visitor::visit (this=0xbfca11dc, ir=0x8a3bcf0) at program/ir_to_mesa.cpp:1596
#1  0x006a3fcb in ir_dereference_array::accept (this=0x8a3bcf0, v=0xbfca11dc) at ir.h:1213
#2  0x00678bb5 in ir_to_mesa_visitor::visit (this=0xbfca11dc, ir=0x898e888) at program/ir_to_mesa.cpp:719
#3  0x006a3cd1 in ir_expression::accept (this=0x898e888, v=0xbfca11dc) at ir.h:725
#4  0x0067ec29 in ir_to_mesa_visitor::visit (this=0xbfca11dc, ir=0x8992158) at program/ir_to_mesa.cpp:2194
#5  0x006a3c53 in ir_if::accept (this=0x8992158, v=0xbfca11dc) at ir.h:446
#6  0x00678656 in ir_to_mesa_visitor::visit (this=0xbfca11dc, ir=0x8992090) at program/ir_to_mesa.cpp:648
#7  0x006a3c29 in ir_function::accept (this=0x8992090, v=0xbfca11dc) at ir.h:377
#8  0x006afb45 in visit_exec_list (list=0x8841328, visitor=0xbfca11dc) at ir.cpp:1039
#9  0x0067fb0a in get_mesa_program (ctx=0x832c6c8, shader_program=0x881e228, shader=0x88e5008) at program/ir_to_mesa.cpp:2475
#10 0x00680392 in _mesa_ir_link_shader (ctx=0x832c6c8, prog=0x881e228) at program/ir_to_mesa.cpp:2642
#11 0x00680951 in _mesa_glsl_link_shader (ctx=0x832c6c8, prog=0x881e228) at program/ir_to_mesa.cpp:2778
#12 0x005a39f3 in link_program (ctx=0x832c6c8, program=3) at main/shaderapi.c:827
#13 0x005a4b13 in _mesa_LinkProgramARB (programObj=3) at main/shaderapi.c:1340
#14 0x0804bbcc in link_and_use_shaders ()
#15 0x0804cc28 in piglit_init ()
#16 0x0804e587 in main ()
(gdb) frame 0
#0  0x0067c5ae in ir_to_mesa_visitor::visit (this=0xbfca11dc, ir=0x8a3bcf0) at program/ir_to_mesa.cpp:1596
1596	   if (strncmp(var->name, "gl_", 3) == 0 && var->mode == ir_var_uniform &&
(gdb) print var
$2 = (class ir_variable *) 0x0

Comment 1 Vinson Lee 2010-08-23 17:24:38 UTC

6606fde3ec18288ecc4c6ce6d3fd32224a6c5248 is the first bad commit
commit 6606fde3ec18288ecc4c6ce6d3fd32224a6c5248
Author: Eric Anholt <eric@anholt.net>
Date:   Sun Aug 22 18:15:20 2010 -0700

    glsl: Convert constant folding to the rvalue visitor.
    
    This should be mostly a noop, except that a plain dereference of a
    variable that is not part of a constant expression could now get
    "constant folded".  I expect that for all current backends this will
    be either a noop, or possibly a win when it provokes more
    ir_algebraic.  It'll also ensure that when new features are added,
    tree walking will work normally.  Before this, constants weren't
    getting folded inside of loops.

:040000 040000 601ca0726891241b4e7dc80c66b3da5f175e48f0 1074a237465baab107934540e0e89c84b9482eb5 M	src
bisect run success

Comment 2 Brian Paul 2010-08-24 08:59:28 UTC

I'm not seeing this with glsl-array-bounds-02 (it just fails) but I am seeing the failed assertion with glsl-fs-main-return on a 32-bit host.  No failed assertions on a 64-bit host.  Also, the assertions doesn't fail when I run in gdb.  Some kind of crazy memory/compiler bug I guess.  I'm trying a few things...

Comment 3 Brian Paul 2010-08-24 09:05:29 UTC

Seems like a gcc bug.  Moving the constructor from the .h file to the .cpp file works around the issue.

I'm using gcc 4.4.4 on 32-bit Linux.

The assertion also failed for me when I ran many other GLSL tests/demos but now they all seem OK.

Fixed with commit 2eb8b2d3bb68cef1d3fc431debe1b18f6c017aeb

Comment 4 Vinson Lee 2010-08-24 17:20:42 UTC

mesa: 2f5bf20e44d509fa3afbe2cfbb9bb65347daea6a (master)

The crash still occurs for me.

Comment 5 Eric Anholt 2010-08-27 14:30:38 UTC

commit 264ba1ab88f273dc92add8018f24edcdd67fa5e5
Author: Eric Anholt <eric@anholt.net>
Date:   Thu Aug 26 11:23:09 2010 -0700

    ir_to_mesa: Don't assume that an ir_dereference_array is of a variable.
    
    Fixes:
    glsl-array-bounds-02 (software)
    glsl-array-bounds-04
    glsl-array-bounds-06 (software)
    glsl-array-bounds-08

Comment 6 Vinson Lee 2010-08-27 18:50:51 UTC

mesa: 977f7d48eefee281cc6bb3ccfb462290854b05cd (master)

Verified fixed.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.